imtokew[.]vip
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Quttera Web Malware Removal is a paid subscription service. Pricing, plans, and trial availability are set by Quttera. Quttera is operated by Quttera Ltd, an independent third-party company unrelated to RCS LT. PCRisk.com may earn a referral commission when users sign up through this link.
Description of imtokew[.]vip
The website appears to present itself as imToken, a cryptocurrency wallet platform focused on Ethereum, Bitcoin, and broader Web3/DeFi asset management. Based on the page title, meta description, and screenshot, it claims to offer non-custodial wallet services, token storage, swapping, staking, and multi-chain support for digital assets such as BTC, ETH, TRX, BNB, and TON.
However, the scanned domain is imtokew[.]vip, which does not match the brand name shown on the page and may be attempting to resemble the legitimate imToken brand. The site appears to be operated through a recently registered standalone domain rather than an obviously established official brand domain, which is a relevant context point when assessing a crypto-related service that asks users to trust wallet software or connect digital assets.
Safety Assessment for imtokew[.]vip
This domain was flagged by 14 out of 94 security engines at the time of the scan, with multiple detections indicating phishing or malicious behavior. In addition, the malware scan reported a malicious result and identified one flagged page element. The domain is also extremely new, with a registration age of only 24 days, and it has no meaningful popularity ranking, both of which can be risk indicators for short-lived phishing infrastructure.
The page content closely resembles the imToken cryptocurrency wallet brand, but the domain name imtokew[.]vip differs from the expected brand spelling and may be a look-alike intended to mislead visitors. In cryptocurrency contexts, this kind of brand resemblance can be especially concerning because users may be prompted to connect wallets, enter seed phrases, or download software. Although one blacklist source reported the domain as clean and some databases had not yet listed it, fresh phishing pages are not always broadly indexed immediately.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid Let's Encrypt TLS certificate, which indicates encrypted HTTPS transport was available at the time of the scan, but a valid certificate alone does not establish legitimacy. The domain is hosted on AWS EC2 in the us-west-2 region using IP address 52.37.165.222, with Dynadot nameservers and DNSSEC reported as unsigned.
From an infrastructure perspective, the combination of a very recently created domain, generic cloud hosting, unsigned DNSSEC, and a short-lived certificate profile is consistent with low-friction deployment. The malware scan also reported a flagged object associated with page content referencing walletconnect.com, which may indicate suspicious use of wallet-connection functionality or abuse of recognizable crypto-related components at the time of analysis.
Share your experience with this website. Was it safe? Did you encounter any issues?